What is recertification?
Recertification is a part of an organization’s governance risk and compliance activity. Recertification or attestation are different terms for the same thing. GRC (governance, risk, and compliance) is a collection of rules and procedures that enable firms to achieve their business goals, deal with uncertainty, and behave with integrity. The goal of the recertification is to present the system data to the auditors and to ensure that there are no nonconformity findings during audits.
Why recertification is needed?
Depending upon the size of the company and whether they are public or non-pubic, and the industry they are in, such as banking or finance, etc., many companies are required by law to perform recertification or attestation of access. A company would like to have risk management in place to prevent people from getting toxic combinations of access that could be a risk to the company. For example, a person might get access to create a purchase order as well as access to approve the same purchase order. This is a toxic combination of access and is a potential risk for a company.
Therefore, to minimize the risk, for all the risky accesses, we should be able to certify and recertify on a regular basis that the access is still needed. For example, is this user account still needed? if a user has already resigned from the company, the user account should not be active. These kinds of potential risks are checked and minimized with the help of recertification at regular intervals.The goal of the recertification is to present the system data to the auditors and to ensure that there are no nonconformity findings during audits. EmpowerID provides a powerful attestation and recertification platform that gives any organization the ability to take a more proactive approach to rectify potential security issues before they occur through crafting EmpowerID audits and
What is a recertification audit?
An audit can be considered as a project with a start date and end date. We might want to audit or certify multiple items using an audit. For example, in a Q1 audit we might want to certify, an external partner, identify as well as a member of certain high-risk management roles. These items are specified in one or more recertification policies. EmpowerID maintains an audit trail of these access snapshots and the decisions made concerning the access.
What is the recertification policy?
As a project might have multiple deliverables an audit can have multiple recertification policies associated with it. We can create recertification policies of different types in the EmpowerID system, and these policies are reusable. For example, in an audit we might want to certify, an external partner, identify as well as a member of certain high-risk management roles. These items are specified in one or more recertification policies.
Recertification Policies are snapshots of data that reveal the access to resources granted to people and to roles, the assignments of people to roles, and the security assignments that have been made against protected resources like Exchange mailboxes, applications, and groups. These snapshots are routed for review to authorized personnel such as managers, role owners, or data owners. The review process allows the reviewer to verify the access and certify whether it is valid. Internal processes can use this data to remediate and rectify exceptions or certify the exceptions as permitted. EmpowerID maintains an audit trail of these access snapshots and the decisions made concerning the access. This
Recertification in EmpowerID
EmpowerID provides a powerful attestation and recertification platform that gives any organization the ability to take a more proactive approach to rectify potential security issues before they occur through crafting EmpowerID audits and recertification policies. The combination of Recertification Policies with EmpowerID's robust reporting capabilities allows organizations to create a more thorough and effective resource management strategy.EmpowerID Recertification Policies come in the
Types of recertification policy
EmpowerID recertification policies has following types.
Recertification Policy Type | Description |
|---|---|
Account validity recertification policy is to certify whether an account should exist or not. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee. The possible decisions are generally configured as certify, disable or delete. However, these decisions are configurable. For more details on how to create an account validity recertification policy visit this page. | |
Business role and location membership policy is to certify the membership of a business role and location. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the business role and location is the bundle for the business request and its members are items. The possible decisions are generally configured as certify or revoke the member. However, these decisions are configurable. For more details on how to create a business role and location membership recertification policy visit this page. | |
The group membership recertification policy is used to certify group membership, including Person resource for RBAC membership, group account, nested groups and any of the type of direct assignments. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the group is the bundle for the business request and its members are items. The possible decisions are generally configured as certify or revoke the member. However, these decisions are configurable. For more details on how to create a group membership recertification policy visit this page. | |
The group validity recertification policy is to certify whether a group should exist or not in the group. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee. The possible decisions are generally configured as certify, disable or delete. However, these decisions are configurable. For more details on how to create an group validity recertification policy visit this page. | |
The management role access assignment recertification policy is to certify the access granted to the management role, including any RBAC assignment. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the management role is the bundle for the business request and its members are items. For more details on how to create a management role access assignment type recertification policy visit this page. | |
The management role membership recertification policy is to certify the current members of a management role, including people, group, and business role and location. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests based on the object itself. Therefore in this case the management role is the bundle for the business request and its members are items. The possible decisions are generally configured as certify or revoke the member. However, these decisions are configurable. For more details on how to create a management role membership recertification policy visit this page. | |
The management role validity recertification policy is to certify the current validity of a management role. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee. This recertification determines if the management role should exist, be "disabled,” or deleted. For more details on how to create a management role validity recertification policy visit this page. | |
The person validity recertification policy is used to certify the person should exist or not. For the recertification, an audit is created, which generates business requests that are sent for approval. The engine bundles the recertification items into business requests as per the responsible party. For any item being recertified where its responsible party is null, it bundles them all into one business request where the subject of the request is the fall-back assignee. The possible decisions are generally configured as certify, disable or delete. However, these decisions are configurable. For more details on how to create a person validity recertification policy visit this page. |
...